L9. Securing Hybrid Connectivity: Virtual WAN, VPN & Microsoft Entra Private Access

Securing an Azure Virtual WAN

Azure Virtual WAN is a networking-as-a-service offering that connects branches, VPN users, and VNets through regional hubs. The security-relevant piece is the secured virtual hub: a Virtual WAN hub with Azure Firewall (or a supported third-party NVA) deployed directly inside it and managed through Azure Firewall Manager, so all traffic transiting the hub, spoke-to-spoke, spoke-to-internet, or branch-to-spoke, is inspected centrally rather than requiring a firewall in every spoke VNet individually. Routing intent is the Virtual WAN configuration that tells the hub to route internet-bound and/or private (inter-spoke) traffic through the secured hub's firewall rather than directly, which is what actually forces inspection to happen instead of merely making the firewall available.

VPN Gateway Security

VPN Gateway connects on-premises networks (site-to-site) or individual devices (point-to-site) to a VNet over an encrypted tunnel:

• Site-to-site (S2S) uses IPsec/IKE to connect an on-premises VPN device to an Azure VPN gateway
• Point-to-site (P2S) connects individual client devices directly, authenticated via Entra ID, certificates, or RADIUS
• Active-active configuration deploys two gateway instances for redundancy, avoiding a single point of failure on a critical hybrid link
• IPsec/IKE policy lets you enforce specific, stronger cryptographic algorithms and key lifetimes instead of the Azure default policy set, when compliance requires a specific cipher suite

Microsoft Entra Private Access

Microsoft Entra Private Access (part of Microsoft's Global Secure Access service) is a Zero Trust Network Access (ZTNA) alternative to a traditional full-tunnel VPN for remote access to internal applications:

• Instead of granting network-level access to an entire subnet the way a VPN does, Private Access publishes individual application segments (specific IP ranges/FQDNs and ports) as discrete resources
• Per-app access means a Conditional Access policy, device compliance check, and access decision apply to each application segment independently, so a compromised or unmanaged device connecting for one approved app still cannot reach anything else on the internal network
• A Quick Access profile can still be configured for a broader set of internal resources during migration from legacy VPN, but the strategic direction is always toward narrower, per-application segments over time
• Because it flows through the same Conditional Access engine as everything else in Entra ID, per-app access to internal resources gets the same risk-based, device-compliance-based, MFA-based controls as SaaS app access, something a traditional site-to-site or point-to-site VPN cannot natively provide

Exam tip: A scenario emphasizing "a compromised remote device should only reach the one internal application it was granted access to, not the entire internal network" is a strong signal for Microsoft Entra Private Access over VPN Gateway, since VPN grants network-level reachability while Private Access enforces per-application segments through Conditional Access.